A Deep Dive into the HTTP 999 Status Code

As mentioned in our ultimate guide to HTTP status codes, HTTP 999 is unofficial, but it still plays an important role in the flow of our online journey in unexpected ways — and here’s why.

So what is it for?

We all know that the digital highway is held together by something called the Hypertext Transfer Protocol, or HTTP.

“Status codes” are like little green or red traffic signals telling your computer if a web page request is good to go, or if there’s a problem you need to address. Website monitoring recognizes them and alerts you.

But in this orderly world of codes and signals, there’s a rebel: the HTTP 999 status code.

HTTP Status Code 999: Unofficial but Significant

So, why isn’t 999 an official HTTP status code?

The reason is pretty simple — it’s not listed in the Status Code Definitions outlined by the Internet Engineering Task Force (IETF), which is the closest thing to an official rulebook for HTTP status codes.

The IEFT lists a bunch of three-digit status codes, each with its own meaning, but HTTP 999 is not part of the list.

Despite its unofficial status, the HTTP 999 status code is used by some websites as a way to control how much traffic they receive from a single source, such as an IP address.

This usage of the 999 code became more prevalent after experts figured out that rate limiting —basically, setting a limit to how much traffic a server can handle from a single source— provides many benefits, including:

• protection against data scraping or DDoS (Distributed Denial-of-Service) attacks (attackers cannot overwhelm a network with a high volume of requests)
• improving user experience by reducing delays
• lowering costs (you don’t have to pay for additional server capacity)

What does the HTTP 999 Status Code Measure?

Simply put, HTTP 999 measures the frequency of requests coming from an IP address within a certain period.

When a system detects an overwhelming amount of requests, it responds with the 999 status code, basically telling the client, “You’re overdoing it. Slow down!”

Think of it as a speed limit for data seekers.

Now, this limit isn’t a one-size-fits-all scenario — it changes based on the server. As a general rule, “with a single CPU core, a web server can handle around 250 concurrent requests at one time, so with 2 CPU cores, your server can handle 500 visitors at the same time, etc.”

That might sound like a good number, but to give you an idea of the reality of big websites, Google processes approximately 63,000 requests every second, or 5.6 billion searches per day.

Small to medium-sized website servers, however, can handle a lot less before they start throwing up rate limit codes, including our 999.

You might think this can’t happen to you if you have a small website, but a large percentage of internet traffic is made up of web crawlers, both good (like those from search engines) and bad (such as scrapers used by hackers).

Given such high traffic, it’s easy to see how servers would often resort to using the 999 code to keep things running smoothly.

Because the 999 code isn’t understood the same way by every website, the response to too many requests can vary — some servers might block the IP address that’s firing off too many requests or they might choose to slow down the response times as a way of protecting themselves.

Where Can You Find HTTP 999 Status Code?

HTTP 999 has become a standard response for some popular websites to protect their data, including LinkedIn.

When LinkedIn detects that a lot of requests are being made from the same IP address or if the requests seem to be automated (as would be the case with a web scraping tool or a bot), it may return an HTTP 999 response to stop these requests. It’s a measure LinkedIn uses to control access to its site, preserve its resources, and protect the data of its users.

Web crawlers that do not respect Linkedin’s robots.txt have to deal with Linkedin’s 999 HTTP response code.

SOURCE: Excellent Web Check

However, the response you get when you’re blocked is not necessarily always 999 — LinkedIn could also return an HTTP 429 error, which is a standard status code for too many requests.

Conclusion

Though unofficial, the HTTP 999 status code serves as a unique solution to an evolving problem, helping you manage web traffic and protect server resources.

However, its usage also highlights the need for a standardized approach to handle similar scenarios.

Are you keeping track of the health of your website and potential HTTP status codes?

Start monitoring website

UptimeRobot can scan your website for error status codes, like 404 (Not Found) or 500 (Internal Server Error) and alert you right away so you can address any issues and minimize downtime.